This invention relates to a method and apparatus for detecting computer viruses, and more particularly to a method and apparatus for increasing the speed at which a computer can scan for the presence of a virus.
The computer field in general has been plagued by the introduction of programs known as computer "viruses", "worms", or "Trojan horses." These programs are often introduced for malicious reasons, and often result in significant damage to both stored data and other software. Many software solutions have been devised to help counter this growing threat to computer file integrity. Among these solutions is a general virus scanner program which scans a file or set of files, for particular known viruses. This method of virus detection is particularly effective against known viruses.
Computer viruses have the particular property of being able to replicate themselves and thus spread from one computer file to another, one computer volume to another, and eventually, from one machine to another. The virus may not be designed to do anything intentionally malicious, but to qualify as a virus, it must have the capability of replicating itself. This distinguishes computer viruses from programs such as "Trojan horses."
Viruses may spread in a number of ways. For example, a virus may spread by adding itself to code that already exists within some program on a computer, then changing that preexisting code in such a way that the newly added viral code will be executed. This will then enable the virus to execute again and replicate itself in yet another program. Examples of such viruses that have affected the Apple Macintosh computer are commonly referred to as nVIR, Scores, ZUC, and ANTI.
A virus may also add itself to some preexisting program (or to the system), but may do so in such a way that it will be automatically executed by the system software running on the computer. It will thus not have to actually modify any preexisting code. Examples of such viruses that have affected the Apple Macintosh computer are named WDEF and CDEF.
In any case, since viruses add themselves to preexisting software, they will usually be changing the lengths or other characteristics of the files or volumes they infect. It is these lengths and other characteristics that can be stored in a cache, and compared with the current state of files and volumes. When these characteristics change, it is an indication that the file or volume should be completely rescanned for viruses. When these characteristics remain the same then it indicates that the file or volume must only be scanned for those viruses which in some way are able to replicate without a change of states being recognizable (either by not changing the states recorded in the cache itself, or by modifying the cache to obscure a change in states). It is thus clear that proper selection of the file and volume characteristics to be stored in the cache will guarantee a great scanning speed increase by eliminating unnecessary, repeat scanning.
The general method for virus scanning is to examine all volume information and files that may be infected by a virus. During the scan each individual virus (or group of viruses) is searched for by looking for the actual viral code, or certain other telltale signs of a virus, such as modified program code. The simplest method to accomplish this is to look for a predetermined string of hexadecimal bytes, the presence of which indicates a specific virus infection. Currently available programs distributed under the names SAM and Disinfectant scan in this manner.
Referring to FIG. 1, the operation of a typical scanning process for a Macintosh computer will now be described. Each volume or directory of files is scanned with the scan starting in step 10. In a preferred embodiment, each file of the volume is scanned starting in step 12. Each file is scanned by examining its resource fork in step 14 and its data fork in step 15 for viruses. On computers which do not have separate resource and data forks the data file itself is scanned. Volumes may also be scanned for viruses. This process is repeated for each volume and each file.
In recent years, not only has the number of viruses increased, but the frequency with which they appear has also generally increased. As the number of viruses increase, the anti-virus programs which use file scanning technologies to search for these viruses must increase their scanning capabilities to handle the new viruses. This increased scanning capability requires extra time to accomplish the scan. Further limitations are imposed on systems which have users with large numbers of files requiring scanning or with moderate to slow computer systems. The overall result of these additional limitations is an increase in the amount of time needed to detect viruses, with a future that promises further increases.
In order to reduce the time it takes to scan for a virus, other solutions have been developed. One such solution introduces programs which detect vital activity, but do not detect specific viruses. Such programs are useful, especially if used in conjunction with vital scanning programs. Such programs, however, do not have the required power and ease of use necessary to supplant the virus scanning programs.
Finally, other solutions simplify and improve detection software in order to speed performance. This has also been useful but as the number of computer viruses increase (sometimes at a seemingly exponential rate), the slowdown due to this increase cancels any time improvement gained from simplifying the software.
It is, therefore, a principal object of the present invention to provide a method and apparatus for increasing the speed at which a computer can scan for the presence of a computer virus.
Another object of the present invention is to provide a method and apparatus for scanning for a computer virus which eliminates the necessity of scanning all portions of all files and volumes for all viruses.